Scriveno converts handwritten math, physics, chemistry, and plain text notes into LaTeX, PDF, DOCX, and Markdown, and can turn the result into spoken audio (a voice-over). This policy explains what personal data we process to do that, on what legal basis, how long we keep it, who we share it with, and the rights you have over it - including under the EU/UK General Data Protection Regulation ("GDPR") if it applies to you.

Who we are

Scriveno is currently operated by an individual, Saroj Adhikari, and is not a registered company. There is no incorporated legal entity behind Scriveno at this time. For the purposes of this policy, "we" and "us" refers to that operator, reachable at support@scriveno.com or by post at Fiskerhusene 29, 2620 Albertslund, Denmark. Under GDPR, an individual can be a "data controller" the same as a company can, and we act as the controller for the personal data described below. If Scriveno is ever incorporated, this section will be updated to name that entity.

The infrastructure behind that operator is not informal, though: every server Scriveno runs on - the ones storing your files and running the AI recognition model - is physically located in Copenhagen, Denmark, and operated by that same individual. Nothing is outsourced to a hosting provider whose location or ownership we can't tell you.

What we collect

Account info: a username, display name, contact email address, and any phone number or avatar you add to your profile. If you sign in with Google, we receive your email address, name, and profile picture from Google instead of a password, and generate a username automatically. When you create an account, we also record when you accepted the Terms and when you confirmed that you are at least 18.
Company info (optional): if you register as a company, the company name and address you type in, and - if an administrator links it - the canonical company record it's matched to.
Uploaded files and converted output: the PDFs/images you upload, and the LaTeX/ PDF/DOCX/Markdown output we generate from them - see How long we keep it below for exactly how long. Original uploads and outputs may contain handwritten academic work, which can include your name or other identifying details if they appear on the page itself.
Voice-over (optional): if you choose to generate a voice-over of a result, we store the generated audio file the same way, and for the same length of time, as your other converted output (see How long we keep it), along with which voice was used and how many characters were voiced, to meter your points balance. See AI processing of your content below for how the voice-over itself is produced.
Corrections you submit (optional): if you suggest a fix to a page's transcription, we store the page image, the original AI output, and your corrected text together, tied to your account. This is entirely your choice - conversion works the same whether or not you ever submit one. See AI processing of your content below for how an approved correction may be reused.
Usage data: your IP address (to enforce the free-tier limit for anonymous use), upload timestamps, and basic conversion metadata such as page count, file name, success or failure, and status. For signed-in conversions, we keep this metadata in your History only while your account exists and delete it when you close your account. For anonymous use, we keep the IP address and timestamp for up to 30 days to enforce the free-tier limit, then delete them.
Payment data: if you subscribe to Pro, top up Developer plan credit, or purchase extra voice-over points, PayPal handles your payment details directly - we never see or store your card or PayPal login information. We only store your PayPal subscription/order ID and payment history (amount, date) to manage your subscription, credit balance, or points balance, and to meet our own financial record-keeping obligations.
Invoices and credit notes: for each payment (and for a credit note, if part of a Developer top-up is refunded), we generate an invoice capturing your name and email - or your company name/address instead, if you'd provided one at the time - as they stood at that moment. While your account is active, invoices and credit notes are downloadable from your profile page. After account deletion, any invoice or credit note that must be retained for accounting is stored separately for the period described under “Payment records” and is no longer available through your profile.
Before you pay: when you continue to PayPal, we record that you ticked the box agreeing that the service starts right away, after being shown your right of withdrawal - together with your account, the product, the time, your language, the version of the wording shown and your IP address.
Cancellations and withdrawals you send us: if you use "Cancel contracts here" or "Withdraw from a contract" at the bottom of every page, we record what you enter - your name, email address, the contract, the type of cancellation, and any purchase, reason, message or preferred end date - together with the time, your language, your IP address, the Scriveno account the email address belongs to (if any), and what we did about it.
Analytics data (only if you accept cookies): if you accept the cookie banner, we use Google Analytics to see aggregate usage patterns - which pages get visited, roughly where from, and on what kind of device. This sets a cookie and is entirely optional; declining, or just not responding to the banner, means it never runs. See Cookies and local storage below.

Our legal bases for processing your data

We process personal data on the following legal bases under Article 6 GDPR:

Performance of a contract (Article 6(1)(b)). We process your account and sign-in details, uploaded pages, transcriptions, generated files, and any narration you request to provide Scriveno’s conversion, download, history, narration, subscription, points, and Developer API features. We also use payment status and transaction details to administer the paid service you choose, and we record your confirmation that you are at least 18, because Scriveno is offered only to adults.

Legitimate interests (Article 6(1)(f)). Our legitimate interests are enforcing page allowances and preventing abuse of free and anonymous use; keeping a keyed usage record for up to 30 days after account deletion so that deleting and recreating an account does not reset its allowance; and protecting registration, sign-in, uploads for conversion, the contact form, the LaTeX tools and connecting the browser extension from automated abuse using reCAPTCHA. For these purposes, we use the IP address and limited usage, conversion, or interaction data needed to enforce limits and protect the service. You may object to processing based on legitimate interests. We will stop unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or need the information for legal claims.

Legal obligation (Article 6(1)(c)). We retain the accounting records, transaction evidence, invoices, and credit notes that Danish law requires us to keep. We retain those records for five years from the end of the financial year to which they relate, unless another applicable law requires a longer period for a particular record. Consumer law also requires us to accept and confirm cancellations and withdrawals, and to be able to show that you agreed to a paid service starting right away. We therefore record what you send us through "Cancel contracts here" and "Withdraw from a contract", and what you confirmed before paying, and keep these records so we can show what was sent, confirmed and agreed.

Consent (Article 6(1)(a)). Google Analytics runs only after you consent to the relevant cookies. We use a submitted correction as a reference example in future recognition requests only if you separately and expressly consent to that use before submitting it. You may withdraw that consent by emailing support@scriveno.com. Withdrawing consent does not affect processing that took place before withdrawal. Declining either optional use does not affect your ability to use the conversion service.

How we use it

To provide the conversion and voice-over services themselves, enforce plan limits, send you account emails (confirmation, password reset, payment receipts), handle and confirm cancellations and withdrawals, and respond if you contact support. We don't sell your data, and we don't use it for advertising or profiling.

AI processing of your content

Converting a page means running its image through a handwriting/formula recognition model. That model is self-hosted - it runs on servers we own and operate ourselves in Copenhagen, Denmark, not a third-party AI provider - so your page images never leave our own servers, in our own country, during recognition. The same is true of the models that find hand-drawn diagrams on a page and read chemical structures: they run on our own hardware, and naming a recognised compound is done from a reference list we hold locally, so nothing about your page is sent anywhere to do it. This is an automated process with no human review of your specific content by us, and no decision with legal or similarly significant effects is made about you as a result of it - it produces a transcription, not a decision about you. It is never used to make any decision about your account, access, or billing. If we ever route recognition through a third-party AI provider instead, we will update this section to name that provider and explain what changes.

Voice-over works the same way. If you choose to generate a voice-over of a result - in any of the 23 languages voice-over supports - the transcribed text is sent to a text-to-speech model that is also self-hosted on our own infrastructure, not a third-party AI provider - the same locally-hosted principle as the recognition models above. Every voice is software-generated; none of them is a recording of a real person's voice.

We do not train or fine-tune our model on your content. Your pages - and any text you have turned into a voice-over - are processed to produce your transcription or voice-over and nothing else - they are not used as training data to improve the model for other users, and the model's underlying weights are never updated from anything you upload. Once a conversion is done, your files follow the same automatic deletion described in How long we keep it below: both what you uploaded and every format we generated from it (PDF/DOCX/Markdown, page images, voice-over audio) are permanently deleted after the file-retention period (currently 7 days) - not archived, not retained for model improvement, regardless of whether you keep using Scriveno or delete your account.

Corrections are not used to train or fine-tune our model. We review and use a correction as a reference example in future users’ recognition requests only if you separately opt in to that use before submitting it. If you opt in and we approve the correction, the page image and corrected text may be included alongside future users’ pages to help recognition. This use is optional and is not needed to convert your own files. You may withdraw your consent by emailing support@scriveno.com; after withdrawal, we will stop using the example in future requests and remove it from the active examples. Withdrawal does not affect processing that took place before you withdrew consent.

Who we share it with

Handwriting/formula recognition itself runs on infrastructure we operate - see AI processing of your content above - so it isn't listed below as a third party. Beyond that, only the third parties needed to run the service, each only for that purpose:

PayPal - processes Pro subscription payments and voice-over points purchases.
Resend - delivers account emails (confirmation, password reset, receipts, and confirmations of cancellations and withdrawals) on our behalf.
Cloudflare - sits in front of our servers and the website for security and reliability, including the API that receives your uploads. It also routes email sent to @scriveno.com (opens in new tab).
Google reCAPTCHA - checks that registration, sign-in, uploads for conversion, the contact form, the LaTeX tools and connecting the browser extension are being used by a person, not a bot. Google receives your IP address and interaction data to decide.
Google Analytics - only runs if you accept the cookie banner. Sees which pages you visit, your approximate location, and basic device/browser info.
Google sign-in - only if you choose "Sign in with Google". Google confirms who you are and shares your name, email address and profile picture with us.

We don't share your data with anyone else, and we don't sell it.

International data transfers

Recognition, voice-over generation and file storage all run on our own servers in Copenhagen, Denmark. Your uploaded files and everything we create from them are stored only there.

To reach those servers, all traffic to scriveno.com (opens in new tab) and api.scriveno.com (opens in new tab) passes through Cloudflare's network, including your uploads and downloads. Cloudflare protects the site against attacks. Cloudflare's servers handle each request to pass it on to ours, but they do not store your files. Email sent to @scriveno.com (opens in new tab) addresses is also routed through Cloudflare.

The providers below may process personal data outside the EU/EEA, including in the United States:

Cloudflare, Inc. - handles all website and API traffic, and incoming email, as our processor. Global network; the company is in the United States. Safeguards: Cloudflare is certified under the EU-U.S. Data Privacy Framework, and its Data Processing Addendum includes the EU Standard Contractual Clauses. Cloudflare is also certified under the EU Cloud Code of Conduct.
Resend (Plus Five Five, Inc.) - sends our account emails, as our processor. Emails are sent from Ireland (EU); the company processes data mainly in the United States. Safeguards: Resend is certified under the EU-U.S. Data Privacy Framework, and its Data Processing Addendum includes the EU Standard Contractual Clauses.
Google Analytics (Google) - usage statistics, only if you accept them, as our processor. United States and other countries. Safeguards: Google LLC is certified under the EU-U.S. Data Privacy Framework, and Google's Ads Data Processing Terms include the EU Standard Contractual Clauses.
Google reCAPTCHA and Google sign-in (Google) - bot checks on protected forms, and signing in with Google if you choose it. Google acts as an independent controller under its own terms. United States and other countries. Safeguard: Google LLC is certified under the EU-U.S. Data Privacy Framework, as described in Google's Privacy Policy.
PayPal (Europe) S.à r.l. et Cie, S.C.A. - subscription and points payments. PayPal acts as an independent controller, because you pay on PayPal. Based in Luxembourg; within the PayPal group, data may also go outside the EU. Safeguard: PayPal's Binding Corporate Rules, approved by Luxembourg's data protection authority (CNPD).

We use each provider's standard data-processing terms and have not negotiated separate agreements. For a copy of the terms for a specific provider, contact us and we will send you the link.

How long we keep it

Uploaded files and converted output

Deleted 7 days after upload, automatically - both the file(s) you uploaded and every format we generated from them (PDF/DOCX/Markdown, page images, and any voice-over audio you generated). This happens whether or not your account still exists, and whether the conversion succeeded or failed.

The one exception: if a correction you submitted for a page is approved as a teaching example (see AI processing of your content), that page's reference image and your corrected text are kept beyond the 7 days for as long as the example stays approved - not indefinitely by default, but for as long as it's in active use. Closing your account does not automatically remove an approved example on its own; email us and we'll un-approve and delete it.

Conversion history and metadata

After the 7-day file deletion above, we keep a record of the conversion itself - file name, page count, date, status, and (if signed in) which account it belonged to - for as long as your account exists, so your History and usage reports keep working. This record never includes the file content itself once the 7-day period has passed.

Account info

Your active account profile and sign-in data are kept while your account exists. When you close your account, we disable sign-in and API keys and delete your profile data, including your phone number, avatar, and company details, and any active uploaded or generated files. Your email address and username are released for reuse, whether or not you previously paid Scriveno. We do not keep a closed sign-in account just to link it to a payment. Any payment or accounting records that must be retained are stored separately for the period described under “Payment records.” An approved correction example may remain only as described under “Uploaded files and converted output”; you can withdraw consent and request its removal as stated there.

Anonymous-use limit data

We keep the IP address and timestamp used to enforce an anonymous free-tier allowance for no more than 30 days after the conversion, then delete them.

Usage after account deletion

When you delete your account, we keep a record of how much of your plan's allowance you had used - the pages you converted in the last 30 days, the pages you converted in total, and this month's voice-over points - for 30 days. This lets us keep free allowances fair: if you sign up again within those 30 days with the same email address or the same Google account, your new account continues from that usage instead of starting a fresh allowance. Addresses Gmail treats as the same inbox count as the same address for this purpose (for example, jane.doe@gmail.com and janedoe+notes@gmail.com).

The allowance record is stored under keyed pseudonymous identifiers derived from your email address and Google sign-in. It does not store those source details directly in the record, but Scriveno can recognize the same identifiers if you return and use them to apply your remaining allowance. The record is therefore pseudonymous personal data, not anonymous data. We use it only to prevent an immediate reset of your usage limits after account deletion. It is deleted automatically within 30 days after account closure, or sooner once its remaining usage has been applied to a new account.

Payment records

We keep payment and accounting records required by Danish bookkeeping law for five years from the end of the financial year to which each record relates. We keep a particular record longer only where another applicable law requires it. These records may include payment identifiers, amounts and dates, subscription dates, Developer credit or voice-over point transactions, and invoices or credit notes. An invoice may contain the name, email address, or company details provided when it was issued. These records are stored separately from your active account and are deleted when their retention period ends.

Cancellations, withdrawals and checkout confirmations

What you send through "Cancel contracts here" or "Withdraw from a contract", and the record of what you confirmed before paying, are kept with the payment records they relate to: for five years from the end of the financial year in which they were made, so that we can show what was sent, confirmed and agreed. They are kept even if you close your account, and deleted when that period ends.

Your rights

If GDPR applies to you, you have the right to:

Access the personal data we hold about you.
Correct it, if it's inaccurate (your display name, email, and phone number can be changed directly from your profile page).
Erasure. You may delete your account from your profile or ask us to do so by emailing support@scriveno.com. Account deletion immediately deletes your active uploads and generated files. We may retain only personal data that must remain for a stated reason: required accounting records, and records of cancellations, withdrawals and checkout confirmations, for the periods described under “How long we keep it”, and the keyed pseudonymous allowance record for no more than 30 days after account closure, or sooner if its remaining usage is applied to a new account. If you withdraw consent to use a correction as a reference example, we will stop including it in future recognition requests and remove it from the active examples.
Restrict or object to certain processing.
Receive a copy of your data in a portable format (data portability) - download it yourself as a JSON file from your profile page, any time.
Lodge a complaint with your local data protection supervisory authority, if you believe we've mishandled your data.

To exercise any of these beyond what's self-service on your profile page, email support@scriveno.com. We'll respond within a reasonable time, and no later than one month as GDPR requires where it applies.

Adults only

Scriveno is for adults. You must be at least 18 years old to use it, and you confirm this when you create an account. We don't knowingly collect personal data from anyone under 18. If you believe someone under 18 has given us personal data, contact us and we'll delete it.

Security

We apply reasonable technical and organizational measures to protect your data - access to production systems is restricted, and payment details are never handled or stored by us directly (PayPal handles them). Our own infrastructure - the servers storing your files and running the recognition and voice-over models - is located in Copenhagen, Denmark, giving it the protection of Danish and EU data protection law regardless of where in the world you access Scriveno from. We do not currently hold a formal third-party security certification (such as ISO 27001 or SOC 2). If you require formal compliance documentation (e.g. for a HECVAT or similar vendor security review) before using Scriveno, contact us to discuss whether we can meet your requirements.

If something goes wrong

If we become aware of a data breach affecting your personal data, we will notify affected users and any required supervisory authority without undue delay, consistent with our obligations under applicable law.

Your choices

You can convert files without an account at all - we only keep minimal usage data (IP + timestamp) tied to that, and the same 7-day file deletion applies.
Change your password, contact email, or phone number any time from your profile page.
Delete your account entirely, any time, from your profile page - this deletes your files immediately and your account with it.
Cancelling a Pro subscription stops future billing; your account reverts to the Free plan. You can cancel from your profile page, or with Cancel contracts here at the bottom of every page without signing in.
Accept or decline Google Analytics any time via "Cookie preferences" in the footer.
If a correction you submitted has been approved as a teaching example, email support@scriveno.com and we'll un-approve and delete it - it will stop being used in future recognition requests once removed.

Cookies and local storage

We keep browser storage to a minimum. The list below comes from a scan of scriveno.com (opens in new tab) in a browser (5 October 2026). Entries marked necessary are needed for something you asked for and are set without consent. Google Analytics is only set if you accept it. You can change your choice at any time through "Cookie preferences" in the footer.

Set by Scriveno

scriveno_auth_token (local storage) - keeps you signed in. Kept until you sign out. Necessary.
scriveno.cookieConsent (local storage) - remembers whether you accepted or declined analytics. Kept until you change your choice or clear your browser. Necessary.
theme (local storage) - remembers light or dark mode, if you choose one. Kept until you change it. Necessary (your setting).
scriveno.language and scriveno.language.lastSeen (local storage) - remember your site language when more than one is offered. Kept until you change it or clear your browser. Necessary (your setting).
scriveno.trackedJobs (session storage) - keeps conversions in progress when you reload the page. Deleted when you close the tab. Necessary.
scriveno.languages (session storage) - remembers which site languages are available. Deleted when you close the tab. Necessary.
scriveno-dismissed-notices (session storage) - hides site notices you have closed. Deleted when you close the tab. Necessary.
.AspNetCore.Correlation.* (cookie on api.scriveno.com (opens in new tab)) - a security check while you sign in with Google. Kept for 15 minutes. Necessary.
.AspNetCore.External (cookie on api.scriveno.com (opens in new tab)) - completes a sign-in with Google. Kept for 10 minutes. Necessary.

Set by Google

_ga and _ga_0H8DFKZWFJ (cookies on scriveno.com (opens in new tab), set by Google Analytics) - count visits and pages viewed so we can see how the site is used, in aggregate. Kept for 400 days. Analytics: only if you accept.
_GRECAPTCHA (cookie on google.com (opens in new tab), set by Google reCAPTCHA) - tells people apart from bots when you submit a protected form. Kept for 180 days. Necessary: it is only set when you submit one of these forms.

We do not use advertising cookies, and we do not use cookies to track you across other websites.

Google reCAPTCHA protects registration, sign-in, uploads for conversion, the contact form, the LaTeX tools and connecting the browser extension. It loads only when you submit one of these. Google then receives your IP address and interaction data to check for automated use.

Google Analytics runs only if you accept it. If you decline, close or ignore the banner, nothing from Google Analytics loads.

Browser extension

The Scriveno browser extension lets you convert a file, or a screenshot of the current tab, without visiting the website. It handles your data the same way the website does - same account, same uploads, same 7-day retention - just from a different starting point. This section covers what's specific to the extension itself.

What it stores on your device: after you sign in, the extension keeps an authentication token in its own private, on-device storage (chrome.storage.local) - not synced to your Google/Firefox account, not shared with any website, and never leaves your device except to authenticate requests to our own API, the same principle as the website's own session storage above. This is what lets it keep working without asking you to sign in again every time.

Screenshots only happen when you ask for one. The extension can only see or capture a tab's content at the exact moment you click "Visible", "Full page", or "Select area" - it does not run in the background, does not read page content passively, and does not act on any tab you haven't explicitly told it to.

It does check, in the background, whether a conversion you already started has finished - roughly once a minute - so it can notify you even if you've closed the extension's popup. That check only asks our own API for the status of a job you already submitted; it never involves reading any tab's content.

Disconnecting it: signing out in the extension ends that connection on our end immediately. You can also see and revoke it at any time from your profile page's "Connected apps" section - uninstalling the extension itself does not delete your account or files, the same as closing the website tab wouldn't.

Changes to this policy

We will update this policy when our data processing changes and show the date of the latest version at the top. If a change is material, we will take reasonable steps to notify you before it takes effect. Where the law requires consent for a new use of your personal data, we will ask for that consent before processing begins. Continued use of Scriveno does not by itself mean that you consent to a new use.

Contact

Questions about this policy or your data? Email support@scriveno.com, use the contact form, or write to us at Fiskerhusene 29, 2620 Albertslund, Denmark.